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Identify a plurality of packets 



610 



Compare source/ 
destination addresses of 
a packet from a first point 
and a second point. 



FIG. 6 




Identify the corresponding destination/source 
address 



Associating the identified destination/source 
address and the matching source/ 
destination address to a flow of unknown 
direction 







Select a pilot packets at each measuring 
point 
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Flow monitor 160 is the nearest the 
j source and flow monitor 1 50 is nearest 
the destination 



Flow monitor 150 is the nearest the 
source and flow monitor 160 is nearest 
the destination 
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Fig. 7 



Get next entry from 
"unknown direction" table. 



Entry in locat "unknown 
direction" table? 
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Direction of data flow from flow monitor 150 
to flow monitor 160. Compute Src and Dst 
networks. Add SrcNet to local network 

address table 295. Add DstNet to network 
address table 290. Add SrcNet/DstNet to 

flow table 280-A. 



Direction of data flow from flow monitor 1 60 
to flow monitor 1 50. Compute Src and Dst 
networks. Add SrcNet to network address 
table 290. Add DstNet to local network 
address table 295. Add SrcNet/DstNet to 
flow table 280-A. 
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Use new location information to identify directions for remainder of flow monitor 150 and flow monitor 

160 "unknown direction" information. Remove entries for which direction has been identified. 
Propagate information to network tables and filters. 



